From 260ef05644420946e7a3c72d93afd0a57adfa0ed Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 14 Jul 2025 21:48:13 +0400 Subject: [PATCH] feat(fips): requested changes (function renaming) --- .../e2e-test/routes/v2/service-token.spec.ts | 4 +- .../20250210101840_webhook-to-kms.ts | 30 ++- ...250210101841_dynamic-secret-root-to-kms.ts | 31 +-- .../20250210101841_secret-rotation-to-kms.ts | 31 +-- .../20250210101842_identity-k8-auth-to-kms.ts | 19 +- ...0250210101842_identity-oidc-auth-to-kms.ts | 17 +- .../20250210101845_directory-config-to-kms.ts | 63 ++--- backend/src/db/seed-data.ts | 73 +++--- backend/src/db/seeds/3-project.ts | 2 +- .../audit-log-stream-service.ts | 19 +- .../ee/services/audit-log/audit-log-queue.ts | 30 ++- backend/src/ee/services/group/group-fns.ts | 15 +- .../secret-approval-request-service.ts | 4 +- .../secret-replication-service.ts | 4 +- .../secret-rotation-queue.ts | 19 +- .../secret-rotation-service.ts | 2 +- .../secret-snapshot-service.ts | 6 +- backend/src/lib/crypto/cryptography/crypto.ts | 218 +++++++++--------- backend/src/lib/crypto/encryption.ts | 6 +- backend/src/lib/crypto/srp.ts | 62 +++-- .../src/services/auth/auth-login-service.ts | 5 +- .../services/auth/auth-password-service.ts | 17 +- .../src/services/auth/auth-signup-service.ts | 34 +-- .../external-migration-queue.ts | 2 +- .../external-migration-service.ts | 2 +- .../group-project/group-project-service.ts | 15 +- .../integration-auth-service.ts | 34 +-- .../integration-delete-secret.ts | 2 +- .../services/org-admin/org-admin-service.ts | 15 +- backend/src/services/org/org-service.ts | 21 +- .../services/project-bot/project-bot-fns.ts | 31 ++- .../project-bot/project-bot-service.ts | 1 + backend/src/services/project/project-queue.ts | 108 +++++---- .../src/services/project/project-service.ts | 3 +- backend/src/services/secret/secret-fns.ts | 72 +++--- backend/src/services/secret/secret-queue.ts | 50 ++-- backend/src/services/secret/secret-service.ts | 163 +++++++------ .../super-admin/super-admin-service.ts | 4 +- backend/src/services/user/user-service.ts | 15 +- 39 files changed, 718 insertions(+), 531 deletions(-) diff --git a/backend/e2e-test/routes/v2/service-token.spec.ts b/backend/e2e-test/routes/v2/service-token.spec.ts index 72a9c4433..025d9796f 100644 --- a/backend/e2e-test/routes/v2/service-token.spec.ts +++ b/backend/e2e-test/routes/v2/service-token.spec.ts @@ -37,7 +37,7 @@ const createServiceToken = async ( const randomBytes = crypto.randomBytes(16).toString("hex"); - const { ciphertext, iv, tag } = crypto.encryption().encryptSymmetric({ + const { ciphertext, iv, tag } = crypto.encryption().symmetric().encrypt({ plaintext: projectKey, key: randomBytes, keySize: SymmetricKeySize.Bits128 @@ -165,7 +165,7 @@ describe("Service token secret ops", async () => { const serviceTokenInfo = serviceTokenInfoRes.json(); const serviceTokenParts = serviceToken.split("."); - projectKey = crypto.encryption().decryptSymmetric({ + projectKey = crypto.encryption().symmetric().decrypt({ key: serviceTokenParts[3], tag: serviceTokenInfo.tag, ciphertext: serviceTokenInfo.encryptedKey, diff --git a/backend/src/db/migrations/20250210101840_webhook-to-kms.ts b/backend/src/db/migrations/20250210101840_webhook-to-kms.ts index 63f1874e3..09a346abb 100644 --- a/backend/src/db/migrations/20250210101840_webhook-to-kms.ts +++ b/backend/src/db/migrations/20250210101840_webhook-to-kms.ts @@ -69,12 +69,15 @@ export async function up(knex: Knex): Promise { let encryptedSecretKey = null; if (el.encryptedSecretKey && el.iv && el.tag && el.keyEncoding) { - const decyptedSecretKey = crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: el.keyEncoding as SecretKeyEncoding, - iv: el.iv, - tag: el.tag, - ciphertext: el.encryptedSecretKey - }); + const decyptedSecretKey = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: el.keyEncoding as SecretKeyEncoding, + iv: el.iv, + tag: el.tag, + ciphertext: el.encryptedSecretKey + }); encryptedSecretKey = projectKmsService.encryptor({ plainText: Buffer.from(decyptedSecretKey, "utf8") }).cipherTextBlob; @@ -82,12 +85,15 @@ export async function up(knex: Knex): Promise { const decryptedUrl = el.urlIV && el.urlTag && el.urlCipherText && el.keyEncoding - ? crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: el.keyEncoding as SecretKeyEncoding, - iv: el.urlIV, - tag: el.urlTag, - ciphertext: el.urlCipherText - }) + ? crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: el.keyEncoding as SecretKeyEncoding, + iv: el.urlIV, + tag: el.urlTag, + ciphertext: el.urlCipherText + }) : null; const encryptedUrl = projectKmsService.encryptor({ diff --git a/backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts b/backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts index ac0395111..94e30a7b8 100644 --- a/backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts +++ b/backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts @@ -63,20 +63,23 @@ export async function up(knex: Knex): Promise { // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.inputIV && el.inputTag && el.inputCiphertext && el.keyEncoding - ? crypto.encryption().decryptWithRootEncryptionKey({ - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - keyEncoding: el.keyEncoding as SecretKeyEncoding, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - iv: el.inputIV, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - tag: el.inputTag, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - ciphertext: el.inputCiphertext - }) + ? crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + keyEncoding: el.keyEncoding as SecretKeyEncoding, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + iv: el.inputIV, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + tag: el.inputTag, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + ciphertext: el.inputCiphertext + }) : ""; const encryptedInput = projectKmsService.encryptor({ diff --git a/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts b/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts index b8e23e757..bbda48dac 100644 --- a/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts +++ b/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts @@ -56,20 +56,23 @@ export async function up(knex: Knex): Promise { // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedDataTag && el.encryptedDataIV && el.encryptedData && el.keyEncoding - ? crypto.encryption().decryptWithRootEncryptionKey({ - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - keyEncoding: el.keyEncoding as SecretKeyEncoding, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - iv: el.encryptedDataIV, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - tag: el.encryptedDataTag, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - ciphertext: el.encryptedData - }) + ? crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + keyEncoding: el.keyEncoding as SecretKeyEncoding, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + iv: el.encryptedDataIV, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + tag: el.encryptedDataTag, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + ciphertext: el.encryptedData + }) : ""; const encryptedRotationData = projectKmsService.encryptor({ diff --git a/backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts b/backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts index 23a8c0e9b..a24bfdf0c 100644 --- a/backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts +++ b/backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts @@ -102,18 +102,21 @@ const reencryptIdentityK8sAuth = async (knex: Knex) => { orgEncryptionRingBuffer.push(orgId, orgKmsService); } - const key = crypto.encryption().decryptWithRootEncryptionKey({ - ciphertext: encryptedSymmetricKey, - iv: symmetricKeyIV, - tag: symmetricKeyTag, - keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding - }); + const key = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + ciphertext: encryptedSymmetricKey, + iv: symmetricKeyIV, + tag: symmetricKeyTag, + keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding + }); const decryptedTokenReviewerJwt = // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedTokenReviewerJwt && el.tokenReviewerJwtIV && el.tokenReviewerJwtTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment @@ -132,7 +135,7 @@ const reencryptIdentityK8sAuth = async (knex: Knex) => { // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedCaCert && el.caCertIV && el.caCertTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment diff --git a/backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts b/backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts index 25dfb69f1..25db615fa 100644 --- a/backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts +++ b/backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts @@ -75,18 +75,21 @@ const reencryptIdentityOidcAuth = async (knex: Knex) => { orgEncryptionRingBuffer.push(orgId, orgKmsService); } - const key = crypto.encryption().decryptWithRootEncryptionKey({ - ciphertext: encryptedSymmetricKey, - iv: symmetricKeyIV, - tag: symmetricKeyTag, - keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding - }); + const key = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + ciphertext: encryptedSymmetricKey, + iv: symmetricKeyIV, + tag: symmetricKeyTag, + keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding + }); const decryptedCertificate = // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedCaCert && el.caCertIV && el.caCertTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment diff --git a/backend/src/db/migrations/20250210101845_directory-config-to-kms.ts b/backend/src/db/migrations/20250210101845_directory-config-to-kms.ts index cd40318a4..783693da6 100644 --- a/backend/src/db/migrations/20250210101845_directory-config-to-kms.ts +++ b/backend/src/db/migrations/20250210101845_directory-config-to-kms.ts @@ -5,12 +5,12 @@ import { crypto, SymmetricKeySize } from "@app/lib/crypto/cryptography"; import { selectAllTableCols } from "@app/lib/knex"; import { initLogger } from "@app/lib/logger"; import { KmsDataKey } from "@app/services/kms/kms-types"; +import { superAdminDALFactory } from "@app/services/super-admin/super-admin-dal"; import { SecretKeyEncoding, TableName } from "../schemas"; import { getMigrationEnvConfig } from "./utils/env-config"; import { createCircularCache } from "./utils/ring-buffer"; import { getMigrationEncryptionServices } from "./utils/services"; -import { superAdminDALFactory } from "@app/services/super-admin/super-admin-dal"; const BATCH_SIZE = 500; const reencryptSamlConfig = async (knex: Knex) => { @@ -61,18 +61,21 @@ const reencryptSamlConfig = async (knex: Knex) => { orgEncryptionRingBuffer.push(el.orgId, orgKmsService); } - const key = crypto.encryption().decryptWithRootEncryptionKey({ - ciphertext: encryptedSymmetricKey, - iv: symmetricKeyIV, - tag: symmetricKeyTag, - keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding - }); + const key = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + ciphertext: encryptedSymmetricKey, + iv: symmetricKeyIV, + tag: symmetricKeyTag, + keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding + }); const decryptedEntryPoint = // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedEntryPoint && el.entryPointIV && el.entryPointTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment @@ -91,7 +94,7 @@ const reencryptSamlConfig = async (knex: Knex) => { // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedIssuer && el.issuerIV && el.issuerTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment @@ -110,7 +113,7 @@ const reencryptSamlConfig = async (knex: Knex) => { // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedCert && el.certIV && el.certTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment @@ -224,18 +227,21 @@ const reencryptLdapConfig = async (knex: Knex) => { orgEncryptionRingBuffer.push(el.orgId, orgKmsService); } - const key = crypto.encryption().decryptWithRootEncryptionKey({ - ciphertext: encryptedSymmetricKey, - iv: symmetricKeyIV, - tag: symmetricKeyTag, - keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding - }); + const key = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + ciphertext: encryptedSymmetricKey, + iv: symmetricKeyIV, + tag: symmetricKeyTag, + keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding + }); const decryptedBindDN = // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedBindDN && el.bindDNIV && el.bindDNTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment @@ -254,7 +260,7 @@ const reencryptLdapConfig = async (knex: Knex) => { // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedBindPass && el.bindPassIV && el.bindPassTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment @@ -273,7 +279,7 @@ const reencryptLdapConfig = async (knex: Knex) => { // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedCACert && el.caCertIV && el.caCertTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment @@ -381,18 +387,21 @@ const reencryptOidcConfig = async (knex: Knex) => { orgEncryptionRingBuffer.push(el.orgId, orgKmsService); } - const key = crypto.encryption().decryptWithRootEncryptionKey({ - ciphertext: encryptedSymmetricKey, - iv: symmetricKeyIV, - tag: symmetricKeyTag, - keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding - }); + const key = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + ciphertext: encryptedSymmetricKey, + iv: symmetricKeyIV, + tag: symmetricKeyTag, + keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding + }); const decryptedClientId = // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedClientId && el.clientIdIV && el.clientIdTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment @@ -411,7 +420,7 @@ const reencryptOidcConfig = async (knex: Knex) => { // eslint-disable-next-line @typescript-eslint/ban-ts-comment // @ts-ignore This will be removed in next cycle so ignore the ts missing error el.encryptedClientSecret && el.clientSecretIV && el.clientSecretTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key, keySize: SymmetricKeySize.Bits256, // eslint-disable-next-line @typescript-eslint/ban-ts-comment diff --git a/backend/src/db/seed-data.ts b/backend/src/db/seed-data.ts index d923e45f1..2aee85fb1 100644 --- a/backend/src/db/seed-data.ts +++ b/backend/src/db/seed-data.ts @@ -84,7 +84,7 @@ export const generateUserSrpKeys = async (password: string) => { ciphertext: encryptedPrivateKey, iv: encryptedPrivateKeyIV, tag: encryptedPrivateKeyTag - } = crypto.encryption().encryptSymmetric({ + } = crypto.encryption().symmetric().encrypt({ plaintext: privateKey, key, keySize: SymmetricKeySize.Bits128 @@ -98,7 +98,8 @@ export const generateUserSrpKeys = async (password: string) => { tag: protectedKeyTag } = crypto .encryption() - .encryptSymmetric({ plaintext: key.toString("hex"), key: derivedKey, keySize: SymmetricKeySize.Bits128 }); + .symmetric() + .encrypt({ plaintext: key.toString("hex"), key: derivedKey, keySize: SymmetricKeySize.Bits128 }); return { protectedKey, @@ -125,21 +126,27 @@ export const getUserPrivateKey = async (password: string, user: TUserEncryptionK }); if (!derivedKey) throw new Error("Failed to derive key from password"); - const key = crypto.encryption().decryptSymmetric({ - ciphertext: user.protectedKey as string, - iv: user.protectedKeyIV as string, - tag: user.protectedKeyTag as string, - key: derivedKey, - keySize: SymmetricKeySize.Bits128 - }); + const key = crypto + .encryption() + .symmetric() + .decrypt({ + ciphertext: user.protectedKey as string, + iv: user.protectedKeyIV as string, + tag: user.protectedKeyTag as string, + key: derivedKey, + keySize: SymmetricKeySize.Bits128 + }); - const privateKey = crypto.encryption().decryptSymmetric({ - ciphertext: user.encryptedPrivateKey, - iv: user.iv, - tag: user.tag, - key: Buffer.from(key, "hex"), - keySize: SymmetricKeySize.Bits128 - }); + const privateKey = crypto + .encryption() + .symmetric() + .decrypt({ + ciphertext: user.encryptedPrivateKey, + iv: user.iv, + tag: user.tag, + key: Buffer.from(key, "hex"), + keySize: SymmetricKeySize.Bits128 + }); return privateKey; }; @@ -164,7 +171,7 @@ export const encryptSecret = (encKey: string, key: string, value?: string, comme ciphertext: secretKeyCiphertext, iv: secretKeyIV, tag: secretKeyTag - } = crypto.encryption().encryptSymmetric({ + } = crypto.encryption().symmetric().encrypt({ plaintext: key, key: encKey, keySize: SymmetricKeySize.Bits128 @@ -175,22 +182,28 @@ export const encryptSecret = (encKey: string, key: string, value?: string, comme ciphertext: secretValueCiphertext, iv: secretValueIV, tag: secretValueTag - } = crypto.encryption().encryptSymmetric({ - plaintext: value ?? "", - key: encKey, - keySize: SymmetricKeySize.Bits128 - }); + } = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: value ?? "", + key: encKey, + keySize: SymmetricKeySize.Bits128 + }); // encrypt comment const { ciphertext: secretCommentCiphertext, iv: secretCommentIV, tag: secretCommentTag - } = crypto.encryption().encryptSymmetric({ - plaintext: comment ?? "", - key: encKey, - keySize: SymmetricKeySize.Bits128 - }); + } = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: comment ?? "", + key: encKey, + keySize: SymmetricKeySize.Bits128 + }); return { secretKeyCiphertext, @@ -206,7 +219,7 @@ export const encryptSecret = (encKey: string, key: string, value?: string, comme }; export const decryptSecret = (decryptKey: string, encSecret: TSecrets) => { - const secretKey = crypto.encryption().decryptSymmetric({ + const secretKey = crypto.encryption().symmetric().decrypt({ key: decryptKey, ciphertext: encSecret.secretKeyCiphertext, tag: encSecret.secretKeyTag, @@ -214,7 +227,7 @@ export const decryptSecret = (decryptKey: string, encSecret: TSecrets) => { keySize: SymmetricKeySize.Bits128 }); - const secretValue = crypto.encryption().decryptSymmetric({ + const secretValue = crypto.encryption().symmetric().decrypt({ key: decryptKey, ciphertext: encSecret.secretValueCiphertext, tag: encSecret.secretValueTag, @@ -224,7 +237,7 @@ export const decryptSecret = (decryptKey: string, encSecret: TSecrets) => { const secretComment = encSecret.secretCommentIV && encSecret.secretCommentTag && encSecret.secretCommentCiphertext - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ key: decryptKey, ciphertext: encSecret.secretCommentCiphertext, tag: encSecret.secretCommentTag, diff --git a/backend/src/db/seeds/3-project.ts b/backend/src/db/seeds/3-project.ts index 91a309aa6..26f96eafb 100644 --- a/backend/src/db/seeds/3-project.ts +++ b/backend/src/db/seeds/3-project.ts @@ -70,7 +70,7 @@ export async function seed(knex: Knex): Promise { const encKey = process.env.ENCRYPTION_KEY; if (!encKey) throw new Error("Missing ENCRYPTION_KEY"); const salt = crypto.randomBytes(16).toString("base64"); - const secretBlindIndex = crypto.encryption().encryptSymmetric({ + const secretBlindIndex = crypto.encryption().symmetric().encrypt({ plaintext: salt, key: encKey, keySize: SymmetricKeySize.Bits128 diff --git a/backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts b/backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts index 2c7086e48..46d2782b3 100644 --- a/backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts +++ b/backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts @@ -88,7 +88,7 @@ export const auditLogStreamServiceFactory = ({ }); const encryptedHeaders = headers - ? crypto.encryption().encryptWithRootEncryptionKey(JSON.stringify(headers)) + ? crypto.encryption().symmetric().encryptWithRootEncryptionKey(JSON.stringify(headers)) : undefined; const logStream = await auditLogStreamDAL.create({ orgId: actorOrgId, @@ -156,7 +156,7 @@ export const auditLogStreamServiceFactory = ({ }); const encryptedHeaders = headers - ? crypto.encryption().encryptWithRootEncryptionKey(JSON.stringify(headers)) + ? crypto.encryption().symmetric().encryptWithRootEncryptionKey(JSON.stringify(headers)) : undefined; const updatedLogStream = await auditLogStreamDAL.updateById(id, { url, @@ -210,12 +210,15 @@ export const auditLogStreamServiceFactory = ({ const headers = logStream?.encryptedHeadersCiphertext && logStream?.encryptedHeadersIV && logStream?.encryptedHeadersTag ? (JSON.parse( - crypto.encryption().decryptWithRootEncryptionKey({ - tag: logStream.encryptedHeadersTag, - iv: logStream.encryptedHeadersIV, - ciphertext: logStream.encryptedHeadersCiphertext, - keyEncoding: logStream.encryptedHeadersKeyEncoding as SecretKeyEncoding - }) + crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + tag: logStream.encryptedHeadersTag, + iv: logStream.encryptedHeadersIV, + ciphertext: logStream.encryptedHeadersCiphertext, + keyEncoding: logStream.encryptedHeadersKeyEncoding as SecretKeyEncoding + }) ) as LogStreamHeaders[]) : undefined; diff --git a/backend/src/ee/services/audit-log/audit-log-queue.ts b/backend/src/ee/services/audit-log/audit-log-queue.ts index 09d666889..be58c4c43 100644 --- a/backend/src/ee/services/audit-log/audit-log-queue.ts +++ b/backend/src/ee/services/audit-log/audit-log-queue.ts @@ -114,12 +114,15 @@ export const auditLogQueueServiceFactory = async ({ const streamHeaders = encryptedHeadersIV && encryptedHeadersCiphertext && encryptedHeadersTag ? (JSON.parse( - crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: encryptedHeadersKeyEncoding as SecretKeyEncoding, - iv: encryptedHeadersIV, - tag: encryptedHeadersTag, - ciphertext: encryptedHeadersCiphertext - }) + crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: encryptedHeadersKeyEncoding as SecretKeyEncoding, + iv: encryptedHeadersIV, + tag: encryptedHeadersTag, + ciphertext: encryptedHeadersCiphertext + }) ) as LogStreamHeaders[]) : []; @@ -216,12 +219,15 @@ export const auditLogQueueServiceFactory = async ({ const streamHeaders = encryptedHeadersIV && encryptedHeadersCiphertext && encryptedHeadersTag ? (JSON.parse( - crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: encryptedHeadersKeyEncoding as SecretKeyEncoding, - iv: encryptedHeadersIV, - tag: encryptedHeadersTag, - ciphertext: encryptedHeadersCiphertext - }) + crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: encryptedHeadersKeyEncoding as SecretKeyEncoding, + iv: encryptedHeadersIV, + tag: encryptedHeadersTag, + ciphertext: encryptedHeadersCiphertext + }) ) as LogStreamHeaders[]) : []; diff --git a/backend/src/ee/services/group/group-fns.ts b/backend/src/ee/services/group/group-fns.ts index af52d2f21..436b0b79e 100644 --- a/backend/src/ee/services/group/group-fns.ts +++ b/backend/src/ee/services/group/group-fns.ts @@ -94,12 +94,15 @@ const addAcceptedUsersToGroup = async ({ }); } - const botPrivateKey = crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: bot.keyEncoding as SecretKeyEncoding, - iv: bot.iv, - tag: bot.tag, - ciphertext: bot.encryptedPrivateKey - }); + const botPrivateKey = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: bot.keyEncoding as SecretKeyEncoding, + iv: bot.iv, + tag: bot.tag, + ciphertext: bot.encryptedPrivateKey + }); const plaintextProjectKey = crypto.encryption().asymmetric().decrypt({ ciphertext: ghostUserLatestKey.encryptedKey, diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts index 9cac1dd43..2a755f9a6 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts @@ -820,7 +820,7 @@ export const secretApprovalRequestServiceFactory = ({ type: SecretType.Shared, references: botKey ? getAllNestedSecretReferences( - crypto.encryption().decryptSymmetric({ + crypto.encryption().symmetric().decrypt({ ciphertext: el.secretValueCiphertext, iv: el.secretValueIV, tag: el.secretValueTag, @@ -866,7 +866,7 @@ export const secretApprovalRequestServiceFactory = ({ ]), references: botKey ? getAllNestedSecretReferences( - crypto.encryption().decryptSymmetric({ + crypto.encryption().symmetric().decrypt({ ciphertext: el.secretValueCiphertext, iv: el.secretValueIV, tag: el.secretValueTag, diff --git a/backend/src/ee/services/secret-replication/secret-replication-service.ts b/backend/src/ee/services/secret-replication/secret-replication-service.ts index 3aa3a1f2a..4a5558f46 100644 --- a/backend/src/ee/services/secret-replication/secret-replication-service.ts +++ b/backend/src/ee/services/secret-replication/secret-replication-service.ts @@ -100,7 +100,7 @@ const getReplicationKeyLockPrefix = (projectId: string, environmentSlug: string, export const getReplicationFolderName = (importId: string) => `${ReservedFolders.SecretReplication}${importId}`; const getDecryptedKeyValue = (key: string, secret: TSecrets) => { - const secretKey = crypto.encryption().decryptSymmetric({ + const secretKey = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretKeyCiphertext, iv: secret.secretKeyIV, tag: secret.secretKeyTag, @@ -108,7 +108,7 @@ const getDecryptedKeyValue = (key: string, secret: TSecrets) => { keySize: SymmetricKeySize.Bits128 }); - const secretValue = crypto.encryption().decryptSymmetric({ + const secretValue = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretValueCiphertext, iv: secret.secretValueIV, tag: secret.secretValueTag, diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts index 8a02d3cd3..1d5c1cedf 100644 --- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts +++ b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts @@ -372,14 +372,17 @@ export const secretRotationQueueFactory = ({ const encryptedSecrets = rotationOutputs.map(({ key: outputKey, secretId }) => ({ secretId, - value: crypto.encryption().encryptSymmetric({ - plaintext: - typeof newCredential.outputs[outputKey] === "object" - ? JSON.stringify(newCredential.outputs[outputKey]) - : String(newCredential.outputs[outputKey]), - key: botKey, - keySize: SymmetricKeySize.Bits128 - }) + value: crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: + typeof newCredential.outputs[outputKey] === "object" + ? JSON.stringify(newCredential.outputs[outputKey]) + : String(newCredential.outputs[outputKey]), + key: botKey, + keySize: SymmetricKeySize.Bits128 + }) })); // map the final values to output keys in the board diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-service.ts b/backend/src/ee/services/secret-rotation/secret-rotation-service.ts index 06aa306d9..53056e294 100644 --- a/backend/src/ee/services/secret-rotation/secret-rotation-service.ts +++ b/backend/src/ee/services/secret-rotation/secret-rotation-service.ts @@ -235,7 +235,7 @@ export const secretRotationServiceFactory = ({ secret: { id: output.secret.id, version: output.secret.version, - secretKey: crypto.encryption().decryptSymmetric({ + secretKey: crypto.encryption().symmetric().decrypt({ ciphertext: output.secret.secretKeyCiphertext, iv: output.secret.secretKeyIV, tag: output.secret.secretKeyTag, diff --git a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts index c6f0c0353..a61b0d586 100644 --- a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts +++ b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts @@ -237,7 +237,7 @@ export const secretSnapshotServiceFactory = ({ snapshotDetails = { ...encryptedSnapshotDetails, secretVersions: encryptedSnapshotDetails.secretVersions.map((el) => { - const secretKey = crypto.encryption().decryptSymmetric({ + const secretKey = crypto.encryption().symmetric().decrypt({ ciphertext: el.secretKeyCiphertext, iv: el.secretKeyIV, tag: el.secretKeyTag, @@ -259,7 +259,7 @@ export const secretSnapshotServiceFactory = ({ let secretValue = ""; if (canReadValue) { - secretValue = crypto.encryption().decryptSymmetric({ + secretValue = crypto.encryption().symmetric().decrypt({ ciphertext: el.secretValueCiphertext, iv: el.secretValueIV, tag: el.secretValueTag, @@ -277,7 +277,7 @@ export const secretSnapshotServiceFactory = ({ secretValue, secretComment: el.secretCommentTag && el.secretCommentIV && el.secretCommentCiphertext - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ ciphertext: el.secretCommentCiphertext, iv: el.secretCommentIV, tag: el.secretCommentTag, diff --git a/backend/src/lib/crypto/cryptography/crypto.ts b/backend/src/lib/crypto/cryptography/crypto.ts index 05f17f750..30f00fa4b 100644 --- a/backend/src/lib/crypto/cryptography/crypto.ts +++ b/backend/src/lib/crypto/cryptography/crypto.ts @@ -221,122 +221,134 @@ const cryptographyFactory = () => { }; }; - const decryptSymmetric = ({ ciphertext, iv, tag, key, keySize }: TDecryptSymmetricInput): string => { - let decipher; + const symmetric = () => { + const decrypt = ({ ciphertext, iv, tag, key, keySize }: TDecryptSymmetricInput): string => { + let decipher; - if (keySize === SymmetricKeySize.Bits128) { - // Not ideal: 128-bit hex key (32 chars) gets interpreted as 32 UTF-8 bytes (256 bits) - // This works but reduces effective key entropy from 256 to 128 bits - decipher = crypto.createDecipheriv(SecretEncryptionAlgo.AES_256_GCM, key, Buffer.from(iv, "base64")); - } else { - const secretKey = crypto.createSecretKey(key, "base64"); - decipher = crypto.createDecipheriv(SecretEncryptionAlgo.AES_256_GCM, secretKey, Buffer.from(iv, "base64")); - } + if (keySize === SymmetricKeySize.Bits128) { + // Not ideal: 128-bit hex key (32 chars) gets interpreted as 32 UTF-8 bytes (256 bits) + // This works but reduces effective key entropy from 256 to 128 bits + decipher = crypto.createDecipheriv(SecretEncryptionAlgo.AES_256_GCM, key, Buffer.from(iv, "base64")); + } else { + const secretKey = crypto.createSecretKey(key, "base64"); + decipher = crypto.createDecipheriv(SecretEncryptionAlgo.AES_256_GCM, secretKey, Buffer.from(iv, "base64")); + } - decipher.setAuthTag(Buffer.from(tag, "base64")); - let cleartext = decipher.update(ciphertext, "base64", "utf8"); - cleartext += decipher.final("utf8"); + decipher.setAuthTag(Buffer.from(tag, "base64")); + let cleartext = decipher.update(ciphertext, "base64", "utf8"); + cleartext += decipher.final("utf8"); - return cleartext; - }; + return cleartext; + }; - const encryptSymmetric = ({ plaintext, key, keySize }: TEncryptSymmetricInput) => { - let iv; - let cipher; + const encrypt = ({ plaintext, key, keySize }: TEncryptSymmetricInput) => { + let iv; + let cipher; - if (keySize === SymmetricKeySize.Bits128) { - iv = crypto.randomBytes(BLOCK_SIZE_BYTES_16); - cipher = crypto.createCipheriv(SecretEncryptionAlgo.AES_256_GCM, key, iv); - } else { - iv = crypto.randomBytes(IV_BYTES_SIZE); - cipher = crypto.createCipheriv(SecretEncryptionAlgo.AES_256_GCM, crypto.createSecretKey(key, "base64"), iv); - } + if (keySize === SymmetricKeySize.Bits128) { + iv = crypto.randomBytes(BLOCK_SIZE_BYTES_16); + cipher = crypto.createCipheriv(SecretEncryptionAlgo.AES_256_GCM, key, iv); + } else { + iv = crypto.randomBytes(IV_BYTES_SIZE); + cipher = crypto.createCipheriv(SecretEncryptionAlgo.AES_256_GCM, crypto.createSecretKey(key, "base64"), iv); + } - let ciphertext = cipher.update(plaintext, "utf8", "base64"); - ciphertext += cipher.final("base64"); + let ciphertext = cipher.update(plaintext, "utf8", "base64"); + ciphertext += cipher.final("base64"); + + return { + ciphertext, + iv: iv.toString("base64"), + tag: cipher.getAuthTag().toString("base64") + }; + }; + + const encryptWithRootEncryptionKey = (data: string) => { + const appCfg = getConfig(); + const rootEncryptionKey = appCfg.ROOT_ENCRYPTION_KEY; + const encryptionKey = appCfg.ENCRYPTION_KEY; + + if (rootEncryptionKey) { + const { iv, tag, ciphertext } = encrypt({ + plaintext: data, + key: rootEncryptionKey, + keySize: SymmetricKeySize.Bits256 + }); + return { + iv, + tag, + ciphertext, + algorithm: SecretEncryptionAlgo.AES_256_GCM, + encoding: SecretKeyEncoding.BASE64 + }; + } + if (encryptionKey) { + const { iv, tag, ciphertext } = encrypt({ + plaintext: data, + key: encryptionKey, + keySize: SymmetricKeySize.Bits128 + }); + return { + iv, + tag, + ciphertext, + algorithm: SecretEncryptionAlgo.AES_256_GCM, + encoding: SecretKeyEncoding.UTF8 + }; + } + throw new CryptographyError({ + message: "Missing both encryption keys" + }); + }; + + const decryptWithRootEncryptionKey = ({ + keyEncoding, + ciphertext, + tag, + iv + }: Omit & { + keyEncoding: SecretKeyEncoding; + }) => { + const appCfg = getConfig(); + // the or gate is used used in migration + const rootEncryptionKey = appCfg?.ROOT_ENCRYPTION_KEY || process.env.ROOT_ENCRYPTION_KEY; + const encryptionKey = appCfg?.ENCRYPTION_KEY || process.env.ENCRYPTION_KEY; + if (rootEncryptionKey && keyEncoding === SecretKeyEncoding.BASE64) { + const data = symmetric().decrypt({ + key: rootEncryptionKey, + iv, + tag, + ciphertext, + keySize: SymmetricKeySize.Bits256 + }); + return data as T; + } + if (encryptionKey && keyEncoding === SecretKeyEncoding.UTF8) { + const data = symmetric().decrypt({ + key: encryptionKey, + iv, + tag, + ciphertext, + keySize: SymmetricKeySize.Bits128 + }); + return data as T; + } + throw new CryptographyError({ + message: "Missing both encryption keys" + }); + }; return { - ciphertext, - iv: iv.toString("base64"), - tag: cipher.getAuthTag().toString("base64") + decrypt, + encrypt, + encryptWithRootEncryptionKey, + decryptWithRootEncryptionKey }; }; - const encryptWithRootEncryptionKey = (data: string) => { - const appCfg = getConfig(); - const rootEncryptionKey = appCfg.ROOT_ENCRYPTION_KEY; - const encryptionKey = appCfg.ENCRYPTION_KEY; - - if (rootEncryptionKey) { - const { iv, tag, ciphertext } = encryptSymmetric({ - plaintext: data, - key: rootEncryptionKey, - keySize: SymmetricKeySize.Bits256 - }); - return { - iv, - tag, - ciphertext, - algorithm: SecretEncryptionAlgo.AES_256_GCM, - encoding: SecretKeyEncoding.BASE64 - }; - } - if (encryptionKey) { - const { iv, tag, ciphertext } = encryptSymmetric({ - plaintext: data, - key: encryptionKey, - keySize: SymmetricKeySize.Bits128 - }); - return { - iv, - tag, - ciphertext, - algorithm: SecretEncryptionAlgo.AES_256_GCM, - encoding: SecretKeyEncoding.UTF8 - }; - } - throw new CryptographyError({ - message: "Missing both encryption keys" - }); - }; - - const decryptWithRootEncryptionKey = ({ - keyEncoding, - ciphertext, - tag, - iv - }: Omit & { - keyEncoding: SecretKeyEncoding; - }) => { - const appCfg = getConfig(); - // the or gate is used used in migration - const rootEncryptionKey = appCfg?.ROOT_ENCRYPTION_KEY || process.env.ROOT_ENCRYPTION_KEY; - const encryptionKey = appCfg?.ENCRYPTION_KEY || process.env.ENCRYPTION_KEY; - if (rootEncryptionKey && keyEncoding === SecretKeyEncoding.BASE64) { - const data = decryptSymmetric({ - key: rootEncryptionKey, - iv, - tag, - ciphertext, - keySize: SymmetricKeySize.Bits256 - }); - return data as T; - } - if (encryptionKey && keyEncoding === SecretKeyEncoding.UTF8) { - const data = decryptSymmetric({ key: encryptionKey, iv, tag, ciphertext, keySize: SymmetricKeySize.Bits128 }); - return data as T; - } - throw new CryptographyError({ - message: "Missing both encryption keys" - }); - }; - return { asymmetric, - encryptWithRootEncryptionKey, - decryptWithRootEncryptionKey, - encryptSymmetric, - decryptSymmetric + symmetric }; }; diff --git a/backend/src/lib/crypto/encryption.ts b/backend/src/lib/crypto/encryption.ts index d11c4ac97..7d2710207 100644 --- a/backend/src/lib/crypto/encryption.ts +++ b/backend/src/lib/crypto/encryption.ts @@ -32,11 +32,13 @@ export const buildSecretBlindIndexFromName = async ({ if (rootEncryptionKey && keyEncoding === SecretKeyEncoding.BASE64) { salt = crypto .encryption() - .decryptSymmetric({ iv, ciphertext, key: rootEncryptionKey, tag, keySize: SymmetricKeySize.Bits256 }); + .symmetric() + .decrypt({ iv, ciphertext, key: rootEncryptionKey, tag, keySize: SymmetricKeySize.Bits256 }); } else if (encryptionKey && keyEncoding === SecretKeyEncoding.UTF8) { salt = crypto .encryption() - .decryptSymmetric({ iv, ciphertext, key: encryptionKey, tag, keySize: SymmetricKeySize.Bits128 }); + .symmetric() + .decrypt({ iv, ciphertext, key: encryptionKey, tag, keySize: SymmetricKeySize.Bits128 }); } if (!salt) throw new Error("Missing secret blind index key"); diff --git a/backend/src/lib/crypto/srp.ts b/backend/src/lib/crypto/srp.ts index 6c4dbc5aa..3f403405e 100644 --- a/backend/src/lib/crypto/srp.ts +++ b/backend/src/lib/crypto/srp.ts @@ -74,11 +74,14 @@ export const generateUserSrpKeys = async ( ciphertext: encryptedPrivateKey, iv: encryptedPrivateKeyIV, tag: encryptedPrivateKeyTag - } = crypto.encryption().encryptSymmetric({ - plaintext: privateKey, - key: key.toString("base64"), - keySize: SymmetricKeySize.Bits256 - }); + } = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: privateKey, + key: key.toString("base64"), + keySize: SymmetricKeySize.Bits256 + }); // create the protected key by encrypting the symmetric key // [key] with the derived key @@ -86,11 +89,14 @@ export const generateUserSrpKeys = async ( ciphertext: protectedKey, iv: protectedKeyIV, tag: protectedKeyTag - } = crypto.encryption().encryptSymmetric({ - plaintext: key.toString("hex"), - key: derivedKey.toString("base64"), - keySize: SymmetricKeySize.Bits256 - }); + } = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: key.toString("hex"), + key: derivedKey.toString("base64"), + keySize: SymmetricKeySize.Bits256 + }); return { protectedKey, @@ -121,13 +127,16 @@ export const getUserPrivateKey = async ( > ) => { if (user.encryptionVersion === UserEncryption.V1) { - return crypto.encryption().decryptSymmetric({ - ciphertext: user.encryptedPrivateKey, - iv: user.iv, - tag: user.tag, - key: password.slice(0, 32).padStart(32 + (password.slice(0, 32).length - new Blob([password]).size), "0"), - keySize: SymmetricKeySize.Bits128 - }); + return crypto + .encryption() + .symmetric() + .decrypt({ + ciphertext: user.encryptedPrivateKey, + iv: user.iv, + tag: user.tag, + key: password.slice(0, 32).padStart(32 + (password.slice(0, 32).length - new Blob([password]).size), "0"), + keySize: SymmetricKeySize.Bits128 + }); } if ( user.encryptionVersion === UserEncryption.V2 && @@ -145,7 +154,7 @@ export const getUserPrivateKey = async ( raw: true }); if (!derivedKey) throw new Error("Failed to derive key from password"); - const key = crypto.encryption().decryptSymmetric({ + const key = crypto.encryption().symmetric().decrypt({ ciphertext: user.protectedKey, iv: user.protectedKeyIV, tag: user.protectedKeyTag, @@ -153,13 +162,16 @@ export const getUserPrivateKey = async ( keySize: SymmetricKeySize.Bits128 }); - const privateKey = crypto.encryption().decryptSymmetric({ - ciphertext: user.encryptedPrivateKey, - iv: user.iv, - tag: user.tag, - key: Buffer.from(key, "hex"), - keySize: SymmetricKeySize.Bits128 - }); + const privateKey = crypto + .encryption() + .symmetric() + .decrypt({ + ciphertext: user.encryptedPrivateKey, + iv: user.iv, + tag: user.tag, + key: Buffer.from(key, "hex"), + keySize: SymmetricKeySize.Bits128 + }); return privateKey; } throw new Error(`GetUserPrivateKey: Encryption version not found`); diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index 8463562bc..aea90fe11 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -336,7 +336,10 @@ export const authLoginServiceFactory = ({ const hashedPassword = await crypto.hashing().createHash(password, cfg.SALT_ROUNDS); - const { iv, tag, ciphertext, encoding } = crypto.encryption().encryptWithRootEncryptionKey(privateKey); + const { iv, tag, ciphertext, encoding } = crypto + .encryption() + .symmetric() + .encryptWithRootEncryptionKey(privateKey); await userDAL.updateUserEncryptionByUserId(userEnc.userId, { serverPrivateKey: null, diff --git a/backend/src/services/auth/auth-password-service.ts b/backend/src/services/auth/auth-password-service.ts index 39ab0a134..0dbdfaf79 100644 --- a/backend/src/services/auth/auth-password-service.ts +++ b/backend/src/services/auth/auth-password-service.ts @@ -222,12 +222,15 @@ export const authPaswordServiceFactory = ({ user.serverEncryptedPrivateKeyEncoding && user.encryptionVersion === UserEncryption.V2 ) { - privateKey = crypto.encryption().decryptWithRootEncryptionKey({ - iv: user.serverEncryptedPrivateKeyIV, - tag: user.serverEncryptedPrivateKeyTag, - ciphertext: user.serverEncryptedPrivateKey, - keyEncoding: user.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding - }); + privateKey = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + iv: user.serverEncryptedPrivateKeyIV, + tag: user.serverEncryptedPrivateKeyTag, + ciphertext: user.serverEncryptedPrivateKey, + keyEncoding: user.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding + }); } else { throw new BadRequestError({ message: "Cannot reset password without current credentials or recovery method", @@ -240,7 +243,7 @@ export const authPaswordServiceFactory = ({ privateKey }); - const { tag, iv, ciphertext, encoding } = crypto.encryption().encryptWithRootEncryptionKey(privateKey); + const { tag, iv, ciphertext, encoding } = crypto.encryption().symmetric().encryptWithRootEncryptionKey(privateKey); await userDAL.updateUserEncryptionByUserId(userId, { hashedPassword: newHashedPassword, diff --git a/backend/src/services/auth/auth-signup-service.ts b/backend/src/services/auth/auth-signup-service.ts index c2c337292..96cf4121a 100644 --- a/backend/src/services/auth/auth-signup-service.ts +++ b/backend/src/services/auth/auth-signup-service.ts @@ -201,7 +201,7 @@ export const authSignupServiceFactory = ({ tag: encryptedPrivateKeyTag, encryptionVersion: UserEncryption.V2 }); - const { tag, encoding, ciphertext, iv } = crypto.encryption().encryptWithRootEncryptionKey(privateKey); + const { tag, encoding, ciphertext, iv } = crypto.encryption().symmetric().encryptWithRootEncryptionKey(privateKey); const updateduser = await authDAL.transaction(async (tx) => { const us = await userDAL.updateById(user.id, { firstName, lastName, isAccepted: true }, tx); if (!us) throw new Error("User not found"); @@ -222,12 +222,15 @@ export const authSignupServiceFactory = ({ systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyEncoding ) { // get server generated password - const serverGeneratedPassword = crypto.encryption().decryptWithRootEncryptionKey({ - iv: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyIV, - tag: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyTag, - ciphertext: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKey, - keyEncoding: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding - }); + const serverGeneratedPassword = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + iv: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyIV, + tag: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyTag, + ciphertext: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKey, + keyEncoding: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding + }); const serverGeneratedPrivateKey = await getUserPrivateKey(serverGeneratedPassword, { ...systemGeneratedUserEncryptionKey }); @@ -444,7 +447,7 @@ export const authSignupServiceFactory = ({ tag: encryptedPrivateKeyTag, encryptionVersion: 2 }); - const { tag, encoding, ciphertext, iv } = crypto.encryption().encryptWithRootEncryptionKey(privateKey); + const { tag, encoding, ciphertext, iv } = crypto.encryption().symmetric().encryptWithRootEncryptionKey(privateKey); const updateduser = await authDAL.transaction(async (tx) => { const us = await userDAL.updateById(user.id, { firstName, lastName, isAccepted: true }, tx); if (!us) throw new Error("User not found"); @@ -461,12 +464,15 @@ export const authSignupServiceFactory = ({ systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyEncoding ) { // get server generated password - const serverGeneratedPassword = crypto.encryption().decryptWithRootEncryptionKey({ - iv: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyIV, - tag: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyTag, - ciphertext: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKey, - keyEncoding: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding - }); + const serverGeneratedPassword = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + iv: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyIV, + tag: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyTag, + ciphertext: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKey, + keyEncoding: systemGeneratedUserEncryptionKey.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding + }); const serverGeneratedPrivateKey = await getUserPrivateKey(serverGeneratedPassword, { ...systemGeneratedUserEncryptionKey }); diff --git a/backend/src/services/external-migration/external-migration-queue.ts b/backend/src/services/external-migration/external-migration-queue.ts index bf4aa5ad0..c4e6b43c5 100644 --- a/backend/src/services/external-migration/external-migration-queue.ts +++ b/backend/src/services/external-migration/external-migration-queue.ts @@ -98,7 +98,7 @@ export const externalMigrationQueueFactory = ({ template: SmtpTemplates.ExternalImportStarted }); - const decrypted = crypto.encryption().decryptWithRootEncryptionKey({ + const decrypted = crypto.encryption().symmetric().decryptWithRootEncryptionKey({ ciphertext: data.ciphertext, iv: data.iv, keyEncoding: data.encoding, diff --git a/backend/src/services/external-migration/external-migration-service.ts b/backend/src/services/external-migration/external-migration-service.ts index 67dbfa1ed..c310fd273 100644 --- a/backend/src/services/external-migration/external-migration-service.ts +++ b/backend/src/services/external-migration/external-migration-service.ts @@ -56,7 +56,7 @@ export const externalMigrationServiceFactory = ({ actorAuthMethod }); - const encrypted = crypto.encryption().encryptWithRootEncryptionKey(stringifiedJson); + const encrypted = crypto.encryption().symmetric().encryptWithRootEncryptionKey(stringifiedJson); await externalMigrationQueue.startImport({ actorEmail: user.email!, diff --git a/backend/src/services/group-project/group-project-service.ts b/backend/src/services/group-project/group-project-service.ts index 21b8efbb8..a04d8b19f 100644 --- a/backend/src/services/group-project/group-project-service.ts +++ b/backend/src/services/group-project/group-project-service.ts @@ -212,12 +212,15 @@ export const groupProjectServiceFactory = ({ }); } - const botPrivateKey = crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: bot.keyEncoding as SecretKeyEncoding, - iv: bot.iv, - tag: bot.tag, - ciphertext: bot.encryptedPrivateKey - }); + const botPrivateKey = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: bot.keyEncoding as SecretKeyEncoding, + iv: bot.iv, + tag: bot.tag, + ciphertext: bot.encryptedPrivateKey + }); const plaintextProjectKey = crypto.encryption().asymmetric().decrypt({ ciphertext: ghostUserLatestKey.encryptedKey, diff --git a/backend/src/services/integration-auth/integration-auth-service.ts b/backend/src/services/integration-auth/integration-auth-service.ts index f49369bad..0729fcb5d 100644 --- a/backend/src/services/integration-auth/integration-auth-service.ts +++ b/backend/src/services/integration-auth/integration-auth-service.ts @@ -218,7 +218,7 @@ export const integrationAuthServiceFactory = ({ } else { if (!botKey) throw new NotFoundError({ message: `Project bot key for project with ID '${projectId}' not found` }); if (tokenExchange.refreshToken) { - const refreshEncToken = crypto.encryption().encryptSymmetric({ + const refreshEncToken = crypto.encryption().symmetric().encrypt({ plaintext: tokenExchange.refreshToken, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -229,7 +229,7 @@ export const integrationAuthServiceFactory = ({ updateDoc.refreshCiphertext = refreshEncToken.ciphertext; } if (tokenExchange.accessToken) { - const accessEncToken = crypto.encryption().encryptSymmetric({ + const accessEncToken = crypto.encryption().symmetric().encrypt({ plaintext: tokenExchange.accessToken, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -355,7 +355,7 @@ export const integrationAuthServiceFactory = ({ url, updateDoc.metadata as Record ); - const refreshEncToken = crypto.encryption().encryptSymmetric({ + const refreshEncToken = crypto.encryption().symmetric().encrypt({ plaintext: tokenDetails.refreshToken, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -363,7 +363,7 @@ export const integrationAuthServiceFactory = ({ updateDoc.refreshIV = refreshEncToken.iv; updateDoc.refreshTag = refreshEncToken.tag; updateDoc.refreshCiphertext = refreshEncToken.ciphertext; - const accessEncToken = crypto.encryption().encryptSymmetric({ + const accessEncToken = crypto.encryption().symmetric().encrypt({ plaintext: tokenDetails.accessToken, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -377,7 +377,7 @@ export const integrationAuthServiceFactory = ({ if (!refreshToken && (accessId || accessToken || awsAssumeIamRoleArn)) { if (accessToken) { - const accessEncToken = crypto.encryption().encryptSymmetric({ + const accessEncToken = crypto.encryption().symmetric().encrypt({ plaintext: accessToken, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -387,7 +387,7 @@ export const integrationAuthServiceFactory = ({ updateDoc.accessCiphertext = accessEncToken.ciphertext; } if (accessId) { - const accessEncToken = crypto.encryption().encryptSymmetric({ + const accessEncToken = crypto.encryption().symmetric().encrypt({ plaintext: accessId, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -397,7 +397,7 @@ export const integrationAuthServiceFactory = ({ updateDoc.accessIdCiphertext = accessEncToken.ciphertext; } if (awsAssumeIamRoleArn) { - const awsAssumeIamRoleArnEnc = crypto.encryption().encryptSymmetric({ + const awsAssumeIamRoleArnEnc = crypto.encryption().symmetric().encrypt({ plaintext: awsAssumeIamRoleArn, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -516,7 +516,7 @@ export const integrationAuthServiceFactory = ({ url, updateDoc.metadata as Record ); - const refreshEncToken = crypto.encryption().encryptSymmetric({ + const refreshEncToken = crypto.encryption().symmetric().encrypt({ plaintext: tokenDetails.refreshToken, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -525,7 +525,7 @@ export const integrationAuthServiceFactory = ({ updateDoc.refreshTag = refreshEncToken.tag; updateDoc.refreshCiphertext = refreshEncToken.ciphertext; - const accessEncToken = crypto.encryption().encryptSymmetric({ + const accessEncToken = crypto.encryption().symmetric().encrypt({ plaintext: tokenDetails.accessToken, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -540,7 +540,7 @@ export const integrationAuthServiceFactory = ({ if (!refreshToken && (accessId || accessToken || awsAssumeIamRoleArn)) { if (accessToken) { - const accessEncToken = crypto.encryption().encryptSymmetric({ + const accessEncToken = crypto.encryption().symmetric().encrypt({ plaintext: accessToken, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -550,7 +550,7 @@ export const integrationAuthServiceFactory = ({ updateDoc.accessCiphertext = accessEncToken.ciphertext; } if (accessId) { - const accessEncToken = crypto.encryption().encryptSymmetric({ + const accessEncToken = crypto.encryption().symmetric().encrypt({ plaintext: accessId, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -560,7 +560,7 @@ export const integrationAuthServiceFactory = ({ updateDoc.accessIdCiphertext = accessEncToken.ciphertext; } if (awsAssumeIamRoleArn) { - const awsAssumeIamRoleArnEnc = crypto.encryption().encryptSymmetric({ + const awsAssumeIamRoleArnEnc = crypto.encryption().symmetric().encrypt({ plaintext: awsAssumeIamRoleArn, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -648,7 +648,7 @@ export const integrationAuthServiceFactory = ({ } else { if (!botKey) throw new NotFoundError({ message: "Project bot key not found" }); if (integrationAuth.accessTag && integrationAuth.accessIV && integrationAuth.accessCiphertext) { - accessToken = crypto.encryption().decryptSymmetric({ + accessToken = crypto.encryption().symmetric().decrypt({ ciphertext: integrationAuth.accessCiphertext, iv: integrationAuth.accessIV, tag: integrationAuth.accessTag, @@ -658,7 +658,7 @@ export const integrationAuthServiceFactory = ({ } if (integrationAuth.refreshCiphertext && integrationAuth.refreshIV && integrationAuth.refreshTag) { - const refreshToken = crypto.encryption().decryptSymmetric({ + const refreshToken = crypto.encryption().symmetric().decrypt({ key: botKey, ciphertext: integrationAuth.refreshCiphertext, iv: integrationAuth.refreshIV, @@ -675,13 +675,13 @@ export const integrationAuthServiceFactory = ({ integrationAuth.metadata as Record ); - const refreshEncToken = crypto.encryption().encryptSymmetric({ + const refreshEncToken = crypto.encryption().symmetric().encrypt({ plaintext: tokenDetails.refreshToken, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const accessEncToken = crypto.encryption().encryptSymmetric({ + const accessEncToken = crypto.encryption().symmetric().encrypt({ plaintext: tokenDetails.accessToken, key: botKey, keySize: SymmetricKeySize.Bits128 @@ -701,7 +701,7 @@ export const integrationAuthServiceFactory = ({ if (!accessToken) throw new BadRequestError({ message: "Missing access token" }); if (integrationAuth.accessIdTag && integrationAuth.accessIdIV && integrationAuth.accessIdCiphertext) { - accessId = crypto.encryption().decryptSymmetric({ + accessId = crypto.encryption().symmetric().decrypt({ key: botKey, ciphertext: integrationAuth.accessIdCiphertext, iv: integrationAuth.accessIdIV, diff --git a/backend/src/services/integration-auth/integration-delete-secret.ts b/backend/src/services/integration-auth/integration-delete-secret.ts index a4923e347..2efec7a47 100644 --- a/backend/src/services/integration-auth/integration-delete-secret.ts +++ b/backend/src/services/integration-auth/integration-delete-secret.ts @@ -111,7 +111,7 @@ const getIntegrationSecretsV1 = async ( const secrets = await secretDAL.findByFolderId(dto.folderId); secrets.forEach((secret) => { - const secretKey = crypto.encryption().decryptSymmetric({ + const secretKey = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretKeyCiphertext, iv: secret.secretKeyIV, tag: secret.secretKeyTag, diff --git a/backend/src/services/org-admin/org-admin-service.ts b/backend/src/services/org-admin/org-admin-service.ts index 81afeedea..6640412c3 100644 --- a/backend/src/services/org-admin/org-admin-service.ts +++ b/backend/src/services/org-admin/org-admin-service.ts @@ -144,12 +144,15 @@ export const orgAdminServiceFactory = ({ }); } - const botPrivateKey = crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: bot.keyEncoding as SecretKeyEncoding, - iv: bot.iv, - tag: bot.tag, - ciphertext: bot.encryptedPrivateKey - }); + const botPrivateKey = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: bot.keyEncoding as SecretKeyEncoding, + iv: bot.iv, + tag: bot.tag, + ciphertext: bot.encryptedPrivateKey + }); const userEncryptionKey = await userDAL.findUserEncKeyByUserId(actorId); if (!userEncryptionKey) diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts index 24a1682a3..cda1bc52f 100644 --- a/backend/src/services/org/org-service.ts +++ b/backend/src/services/org/org-service.ts @@ -508,14 +508,14 @@ export const orgServiceFactory = ({ tag: privateKeyTag, encoding: privateKeyKeyEncoding, algorithm: privateKeyAlgorithm - } = crypto.encryption().encryptWithRootEncryptionKey(privateKey); + } = crypto.encryption().symmetric().encryptWithRootEncryptionKey(privateKey); const { ciphertext: encryptedSymmetricKey, iv: symmetricKeyIV, tag: symmetricKeyTag, encoding: symmetricKeyKeyEncoding, algorithm: symmetricKeyAlgorithm - } = crypto.encryption().encryptWithRootEncryptionKey(key); + } = crypto.encryption().symmetric().encryptWithRootEncryptionKey(key); const customerId = await licenseService.generateOrgCustomerId(orgName, userEmail); const organization = await orgDAL.transaction(async (tx) => { @@ -879,6 +879,7 @@ export const orgServiceFactory = ({ const serverGeneratedPassword = crypto.randomBytes(32).toString("hex"); const { tag, encoding, ciphertext, iv } = crypto .encryption() + .symmetric() .encryptWithRootEncryptionKey(serverGeneratedPassword); const encKeys = await generateUserSrpKeys(inviteeEmail, serverGeneratedPassword); await userDAL.createUserEncryption( @@ -1099,6 +1100,7 @@ export const orgServiceFactory = ({ const { iv, tag, ciphertext, encoding, algorithm } = crypto .encryption() + .symmetric() .encryptWithRootEncryptionKey(newGhostUser.keys.plainPrivateKey); if (autoGeneratedBot) { await projectBotDAL.updateById( @@ -1137,12 +1139,15 @@ export const orgServiceFactory = ({ }); } - const botPrivateKey = crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: bot.keyEncoding as SecretKeyEncoding, - iv: bot.iv, - tag: bot.tag, - ciphertext: bot.encryptedPrivateKey - }); + const botPrivateKey = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: bot.keyEncoding as SecretKeyEncoding, + iv: bot.iv, + tag: bot.tag, + ciphertext: bot.encryptedPrivateKey + }); const newWsMembers = assignWorkspaceKeysToMembers({ decryptKey: ghostUserLatestKey, diff --git a/backend/src/services/project-bot/project-bot-fns.ts b/backend/src/services/project-bot/project-bot-fns.ts index daf6fa33e..d26669b86 100644 --- a/backend/src/services/project-bot/project-bot-fns.ts +++ b/backend/src/services/project-bot/project-bot-fns.ts @@ -7,12 +7,15 @@ import { TProjectDALFactory } from "../project/project-dal"; import { TGetPrivateKeyDTO } from "./project-bot-types"; export const getBotPrivateKey = ({ bot }: TGetPrivateKeyDTO) => { - return crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: bot.keyEncoding as SecretKeyEncoding, - iv: bot.iv, - tag: bot.tag, - ciphertext: bot.encryptedPrivateKey - }); + return crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: bot.keyEncoding as SecretKeyEncoding, + iv: bot.iv, + tag: bot.tag, + ciphertext: bot.encryptedPrivateKey + }); }; export const getBotKeyFnFactory = ( @@ -46,12 +49,15 @@ export const getBotKeyFnFactory = ( projectV1Keys.serverEncryptedPrivateKeyTag && projectV1Keys.serverEncryptedPrivateKeyEncoding ) { - userPrivateKey = crypto.encryption().decryptWithRootEncryptionKey({ - iv: projectV1Keys.serverEncryptedPrivateKeyIV, - tag: projectV1Keys.serverEncryptedPrivateKeyTag, - ciphertext: projectV1Keys.serverEncryptedPrivateKey, - keyEncoding: projectV1Keys.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding - }); + userPrivateKey = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + iv: projectV1Keys.serverEncryptedPrivateKeyIV, + tag: projectV1Keys.serverEncryptedPrivateKeyTag, + ciphertext: projectV1Keys.serverEncryptedPrivateKey, + keyEncoding: projectV1Keys.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding + }); } const workspaceKey = crypto.encryption().asymmetric().decrypt({ ciphertext: projectV1Keys.projectEncryptedKey, @@ -62,6 +68,7 @@ export const getBotKeyFnFactory = ( const botKey = await crypto.encryption().asymmetric().generateKeyPair(); const { iv, tag, ciphertext, encoding, algorithm } = crypto .encryption() + .symmetric() .encryptWithRootEncryptionKey(botKey.privateKey); const encryptedWorkspaceKey = crypto .encryption() diff --git a/backend/src/services/project-bot/project-bot-service.ts b/backend/src/services/project-bot/project-bot-service.ts index ab2eb7b52..76c40dff7 100644 --- a/backend/src/services/project-bot/project-bot-service.ts +++ b/backend/src/services/project-bot/project-bot-service.ts @@ -58,6 +58,7 @@ export const projectBotServiceFactory = ({ const { iv, tag, ciphertext, encoding, algorithm } = crypto .encryption() + .symmetric() .encryptWithRootEncryptionKey(keys.privateKey); const project = await projectDAL.findById(projectId, tx); diff --git a/backend/src/services/project/project-queue.ts b/backend/src/services/project/project-queue.ts index ed6241bc7..0d7c7dd55 100644 --- a/backend/src/services/project/project-queue.ts +++ b/backend/src/services/project/project-queue.ts @@ -114,7 +114,7 @@ export const projectQueueFactory = ({ await projectDAL.setProjectUpgradeStatus(data.projectId, ProjectUpgradeStatus.InProgress); // Set the status to in progress. This is important to prevent multiple upgrades at the same time. - const userPrivateKey = crypto.encryption().decryptWithRootEncryptionKey({ + const userPrivateKey = crypto.encryption().symmetric().decryptWithRootEncryptionKey({ keyEncoding: data.encryptedPrivateKey.keyEncoding, ciphertext: data.encryptedPrivateKey.encryptedKey, iv: data.encryptedPrivateKey.encryptedKeyIv, @@ -316,6 +316,7 @@ export const projectQueueFactory = ({ // Encrypt the bot private key (which is the same as the ghost user) const { iv, tag, ciphertext, encoding, algorithm } = crypto .encryption() + .symmetric() .encryptWithRootEncryptionKey(ghostUser.keys.plainPrivateKey); // 5. Create a bot for the project @@ -337,12 +338,15 @@ export const projectQueueFactory = ({ tx ); - const botPrivateKey = crypto.encryption().decryptWithRootEncryptionKey({ - keyEncoding: newBot.keyEncoding as SecretKeyEncoding, - iv: newBot.iv, - tag: newBot.tag, - ciphertext: newBot.encryptedPrivateKey - }); + const botPrivateKey = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + keyEncoding: newBot.keyEncoding as SecretKeyEncoding, + iv: newBot.iv, + tag: newBot.tag, + ciphertext: newBot.encryptedPrivateKey + }); const botKey = crypto.encryption().asymmetric().decrypt({ ciphertext: newBot.encryptedProjectKey!, @@ -356,23 +360,29 @@ export const projectQueueFactory = ({ const updatedSecretApprovals: TSecretApprovalRequestsSecrets[] = []; const updatedIntegrationAuths: TIntegrationAuths[] = []; for (const rawSecret of decryptedSecrets) { - const secretKeyEncrypted = crypto.encryption().encryptSymmetric({ + const secretKeyEncrypted = crypto.encryption().symmetric().encrypt({ plaintext: rawSecret.decrypted.secretKey, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const secretValueEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: rawSecret.decrypted.secretValue || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretValueEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: rawSecret.decrypted.secretValue || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); - const secretCommentEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: rawSecret.decrypted.secretComment || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretCommentEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: rawSecret.decrypted.secretComment || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); const payload: TSecrets = { ...rawSecret.original, @@ -399,23 +409,29 @@ export const projectQueueFactory = ({ } for (const rawSecretVersion of decryptedSecretVersions) { - const secretKeyEncrypted = crypto.encryption().encryptSymmetric({ + const secretKeyEncrypted = crypto.encryption().symmetric().encrypt({ plaintext: rawSecretVersion.decrypted.secretKey, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const secretValueEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: rawSecretVersion.decrypted.secretValue || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretValueEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: rawSecretVersion.decrypted.secretValue || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); - const secretCommentEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: rawSecretVersion.decrypted.secretComment || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretCommentEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: rawSecretVersion.decrypted.secretComment || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); const payload: TSecretVersions = { ...rawSecretVersion.original, @@ -442,21 +458,27 @@ export const projectQueueFactory = ({ } for (const rawSecretApproval of decryptedApprovalSecrets) { - const secretKeyEncrypted = crypto.encryption().encryptSymmetric({ + const secretKeyEncrypted = crypto.encryption().symmetric().encrypt({ plaintext: rawSecretApproval.decrypted.secretKey, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const secretValueEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: rawSecretApproval.decrypted.secretValue || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); - const secretCommentEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: rawSecretApproval.decrypted.secretComment || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretValueEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: rawSecretApproval.decrypted.secretValue || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); + const secretCommentEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: rawSecretApproval.decrypted.secretComment || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); const payload: TSecretApprovalRequestsSecrets = { ...rawSecretApproval.original, @@ -483,17 +505,17 @@ export const projectQueueFactory = ({ } for (const integrationAuth of decryptedIntegrationAuths) { - const access = crypto.encryption().encryptSymmetric({ + const access = crypto.encryption().symmetric().encrypt({ plaintext: integrationAuth.decrypted.access, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const accessId = crypto.encryption().encryptSymmetric({ + const accessId = crypto.encryption().symmetric().encrypt({ plaintext: integrationAuth.decrypted.accessId, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const refresh = crypto.encryption().encryptSymmetric({ + const refresh = crypto.encryption().symmetric().encrypt({ plaintext: integrationAuth.decrypted.refresh, key: botKey, keySize: SymmetricKeySize.Bits128 diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index cff47ff29..de35c11f4 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -379,6 +379,7 @@ export const projectServiceFactory = ({ const { iv, tag, ciphertext, encoding, algorithm } = crypto .encryption() + .symmetric() .encryptWithRootEncryptionKey(ghostUser.keys.plainPrivateKey); // 5. Create & a bot for the project @@ -822,7 +823,7 @@ export const projectServiceFactory = ({ }); } - const encryptedPrivateKey = crypto.encryption().encryptWithRootEncryptionKey(userPrivateKey); + const encryptedPrivateKey = crypto.encryption().symmetric().encryptWithRootEncryptionKey(userPrivateKey); await projectQueue.upgradeProject({ projectId, diff --git a/backend/src/services/secret/secret-fns.ts b/backend/src/services/secret/secret-fns.ts index 937367d67..15a31a331 100644 --- a/backend/src/services/secret/secret-fns.ts +++ b/backend/src/services/secret/secret-fns.ts @@ -234,14 +234,14 @@ export const interpolateSecrets = ({ projectId, secretEncKey, secretDAL, folderD const secrets = await secretDAL.findByFolderId(folder.id); const decryptedSec = secrets.reduce>((prev, secret) => { - const decryptedSecretKey = crypto.encryption().decryptSymmetric({ + const decryptedSecretKey = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretKeyCiphertext, iv: secret.secretKeyIV, tag: secret.secretKeyTag, key: secretEncKey, keySize: SymmetricKeySize.Bits128 }); - const decryptedSecretValue = crypto.encryption().decryptSymmetric({ + const decryptedSecretValue = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretValueCiphertext, iv: secret.secretValueIV, tag: secret.secretValueTag, @@ -363,7 +363,7 @@ export const decryptSecretRaw = ( }, key: string ) => { - const secretKey = crypto.encryption().decryptSymmetric({ + const secretKey = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretKeyCiphertext, iv: secret.secretKeyIV, tag: secret.secretKeyTag, @@ -372,7 +372,7 @@ export const decryptSecretRaw = ( }); const secretValue = !secret.secretValueHidden - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretValueCiphertext, iv: secret.secretValueIV, tag: secret.secretValueTag, @@ -384,7 +384,7 @@ export const decryptSecretRaw = ( let secretComment = ""; if (secret.secretCommentCiphertext && secret.secretCommentIV && secret.secretCommentTag) { - secretComment = crypto.encryption().decryptSymmetric({ + secretComment = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretCommentCiphertext, iv: secret.secretCommentIV, tag: secret.secretCommentTag, @@ -879,22 +879,28 @@ export const createManySecretsRawFnFactory = ({ }); const inputSecrets = secrets.map((secret) => { - const secretKeyEncrypted = crypto.encryption().encryptSymmetric({ + const secretKeyEncrypted = crypto.encryption().symmetric().encrypt({ plaintext: secret.secretName, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const secretValueEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secret.secretValue || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretValueEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secret.secretValue || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); const secretReferences = getAllNestedSecretReferences(secret.secretValue || ""); - const secretCommentEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secret.secretComment || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretCommentEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secret.secretComment || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); return { type: secret.type, @@ -1078,22 +1084,28 @@ export const updateManySecretsRawFnFactory = ({ throw new BadRequestError({ message: "New secret name cannot be empty" }); } - const secretKeyEncrypted = crypto.encryption().encryptSymmetric({ + const secretKeyEncrypted = crypto.encryption().symmetric().encrypt({ plaintext: secret.secretName, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const secretValueEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secret.secretValue || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretValueEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secret.secretValue || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); const secretReferences = getAllNestedSecretReferences(secret.secretValue || ""); - const secretCommentEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secret.secretComment || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretCommentEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secret.secretComment || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); return { type: secret.type, @@ -1176,7 +1188,7 @@ export const decryptSecretWithBot = ( >, key: string ) => { - const secretKey = crypto.encryption().decryptSymmetric({ + const secretKey = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretKeyCiphertext, iv: secret.secretKeyIV, tag: secret.secretKeyTag, @@ -1184,7 +1196,7 @@ export const decryptSecretWithBot = ( keySize: SymmetricKeySize.Bits128 }); - const secretValue = crypto.encryption().decryptSymmetric({ + const secretValue = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretValueCiphertext, iv: secret.secretValueIV, tag: secret.secretValueTag, @@ -1195,7 +1207,7 @@ export const decryptSecretWithBot = ( let secretComment = ""; if (secret.secretCommentCiphertext && secret.secretCommentIV && secret.secretCommentTag) { - secretComment = crypto.encryption().decryptSymmetric({ + secretComment = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretCommentCiphertext, iv: secret.secretCommentIV, tag: secret.secretCommentTag, diff --git a/backend/src/services/secret/secret-queue.ts b/backend/src/services/secret/secret-queue.ts index dbca65385..8fcaa6e34 100644 --- a/backend/src/services/secret/secret-queue.ts +++ b/backend/src/services/secret/secret-queue.ts @@ -503,7 +503,7 @@ export const secretQueueFactory = ({ const secrets = await secretDAL.findByFolderId(dto.folderId); await Promise.allSettled( secrets.map(async (secret) => { - const secretKey = crypto.encryption().decryptSymmetric({ + const secretKey = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretKeyCiphertext, iv: secret.secretKeyIV, tag: secret.secretKeyTag, @@ -511,7 +511,7 @@ export const secretQueueFactory = ({ keySize: SymmetricKeySize.Bits128 }); - const secretValue = crypto.encryption().decryptSymmetric({ + const secretValue = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretValueCiphertext, iv: secret.secretValueIV, tag: secret.secretValueTag, @@ -528,7 +528,7 @@ export const secretQueueFactory = ({ content[secretKey] = { value: expandedSecretValue || "" }; if (secret.secretCommentCiphertext && secret.secretCommentIV && secret.secretCommentTag) { - const commentValue = crypto.encryption().decryptSymmetric({ + const commentValue = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretCommentCiphertext, iv: secret.secretCommentIV, tag: secret.secretCommentTag, @@ -954,13 +954,16 @@ export const secretQueueFactory = ({ integrationAuth.awsAssumeIamRoleArnIV && integrationAuth.awsAssumeIamRoleArnCipherText ) { - awsAssumeRoleArn = crypto.encryption().decryptSymmetric({ - ciphertext: integrationAuth.awsAssumeIamRoleArnCipherText, - iv: integrationAuth.awsAssumeIamRoleArnIV, - tag: integrationAuth.awsAssumeIamRoleArnTag, - key: botKey as string, - keySize: SymmetricKeySize.Bits128 - }); + awsAssumeRoleArn = crypto + .encryption() + .symmetric() + .decrypt({ + ciphertext: integrationAuth.awsAssumeIamRoleArnCipherText, + iv: integrationAuth.awsAssumeIamRoleArnIV, + tag: integrationAuth.awsAssumeIamRoleArnTag, + key: botKey as string, + keySize: SymmetricKeySize.Bits128 + }); } const suffixedSecrets: typeof secrets = {}; @@ -1241,6 +1244,7 @@ export const secretQueueFactory = ({ ); const { iv, tag, ciphertext, encoding, algorithm } = crypto .encryption() + .symmetric() .encryptWithRootEncryptionKey(ghostUser.keys.plainPrivateKey); await projectBotDAL.updateById( bot.id, @@ -1275,14 +1279,14 @@ export const secretQueueFactory = ({ await secretV2BridgeDAL.batchInsert( projectV1Secrets.map((el) => { - const key = crypto.encryption().decryptSymmetric({ + const key = crypto.encryption().symmetric().decrypt({ ciphertext: el.secretKeyCiphertext, iv: el.secretKeyIV, tag: el.secretKeyTag, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const value = crypto.encryption().decryptSymmetric({ + const value = crypto.encryption().symmetric().decrypt({ ciphertext: el.secretValueCiphertext, iv: el.secretValueIV, tag: el.secretValueTag, @@ -1291,7 +1295,7 @@ export const secretQueueFactory = ({ }); const comment = el.secretCommentCiphertext && el.secretCommentTag && el.secretCommentIV - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ ciphertext: el.secretCommentCiphertext, iv: el.secretCommentIV, tag: el.secretCommentTag, @@ -1346,14 +1350,14 @@ export const secretQueueFactory = ({ }); if (projectV3SecretVersionsGroupById[el.id]) return; - const key = crypto.encryption().decryptSymmetric({ + const key = crypto.encryption().symmetric().decrypt({ ciphertext: el.secretKeyCiphertext, iv: el.secretKeyIV, tag: el.secretKeyTag, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const value = crypto.encryption().decryptSymmetric({ + const value = crypto.encryption().symmetric().decrypt({ ciphertext: el.secretValueCiphertext, iv: el.secretValueIV, tag: el.secretValueTag, @@ -1362,7 +1366,7 @@ export const secretQueueFactory = ({ }); const comment = el.secretCommentCiphertext && el.secretCommentTag && el.secretCommentIV - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ ciphertext: el.secretCommentCiphertext, iv: el.secretCommentIV, tag: el.secretCommentTag, @@ -1408,14 +1412,14 @@ export const secretQueueFactory = ({ ); Object.values(latestSecretVersionByFolder).forEach((el) => { if (projectV3SecretVersionsGroupById[el.id]) return; - const key = crypto.encryption().decryptSymmetric({ + const key = crypto.encryption().symmetric().decrypt({ ciphertext: el.secretKeyCiphertext, iv: el.secretKeyIV, tag: el.secretKeyTag, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const value = crypto.encryption().decryptSymmetric({ + const value = crypto.encryption().symmetric().decrypt({ ciphertext: el.secretValueCiphertext, iv: el.secretValueIV, tag: el.secretValueTag, @@ -1424,7 +1428,7 @@ export const secretQueueFactory = ({ }); const comment = el.secretCommentCiphertext && el.secretCommentTag && el.secretCommentIV - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ ciphertext: el.secretCommentCiphertext, iv: el.secretCommentIV, tag: el.secretCommentTag, @@ -1496,7 +1500,7 @@ export const secretQueueFactory = ({ projectV1IntegrationAuths.map((el) => { const accessToken = el.accessIV && el.accessTag && el.accessCiphertext - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ ciphertext: el.accessCiphertext, iv: el.accessIV, tag: el.accessTag, @@ -1506,7 +1510,7 @@ export const secretQueueFactory = ({ : undefined; const accessId = el.accessIdIV && el.accessIdTag && el.accessIdCiphertext - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ ciphertext: el.accessIdCiphertext, iv: el.accessIdIV, tag: el.accessIdTag, @@ -1516,7 +1520,7 @@ export const secretQueueFactory = ({ : undefined; const refreshToken = el.refreshIV && el.refreshTag && el.refreshCiphertext - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ ciphertext: el.refreshCiphertext, iv: el.refreshIV, tag: el.refreshTag, @@ -1526,7 +1530,7 @@ export const secretQueueFactory = ({ : undefined; const awsAssumeRoleArn = el.awsAssumeIamRoleArnCipherText && el.awsAssumeIamRoleArnIV && el.awsAssumeIamRoleArnTag - ? crypto.encryption().decryptSymmetric({ + ? crypto.encryption().symmetric().decrypt({ ciphertext: el.awsAssumeIamRoleArnCipherText, iv: el.awsAssumeIamRoleArnIV, tag: el.awsAssumeIamRoleArnTag, diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 83e586360..084423fa9 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -158,13 +158,16 @@ export const secretServiceFactory = ({ return (el: { ciphertext?: string; iv: string; tag: string }) => projectBot?.botKey ? getAllNestedSecretReferences( - crypto.encryption().decryptSymmetric({ - ciphertext: el.ciphertext || "", - iv: el.iv, - tag: el.tag, - key: projectBot.botKey, - keySize: SymmetricKeySize.Bits128 - }) + crypto + .encryption() + .symmetric() + .decrypt({ + ciphertext: el.ciphertext || "", + iv: el.iv, + tag: el.tag, + key: projectBot.botKey, + keySize: SymmetricKeySize.Bits128 + }) ) : undefined; }; @@ -1695,21 +1698,27 @@ export const secretServiceFactory = ({ name: "bot_not_found_error" }); - const secretKeyEncrypted = crypto.encryption().encryptSymmetric({ + const secretKeyEncrypted = crypto.encryption().symmetric().encrypt({ plaintext: secretName, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const secretValueEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secretValue || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); - const secretCommentEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secretComment || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretValueEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secretValue || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); + const secretCommentEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secretComment || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); if (policy) { const approval = await secretApprovalRequestService.generateSecretApprovalRequest({ policy, @@ -1875,22 +1884,31 @@ export const secretServiceFactory = ({ name: "bot_not_found_error" }); - const secretValueEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secretValue || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); - const secretCommentEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secretComment || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretValueEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secretValue || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); + const secretCommentEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secretComment || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); - const secretKeyEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: newSecretName || secretName, - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretKeyEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: newSecretName || secretName, + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); if (policy) { const approval = await secretApprovalRequestService.generateSecretApprovalRequest({ @@ -2137,21 +2155,27 @@ export const secretServiceFactory = ({ const sanitizedSecrets = inputSecrets.map( ({ secretComment, secretKey, metadata, tagIds, secretValue, skipMultilineEncoding }) => { - const secretKeyEncrypted = crypto.encryption().encryptSymmetric({ + const secretKeyEncrypted = crypto.encryption().symmetric().encrypt({ plaintext: secretKey, key: botKey, keySize: SymmetricKeySize.Bits128 }); - const secretValueEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secretValue || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); - const secretCommentEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secretComment || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretValueEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secretValue || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); + const secretCommentEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secretComment || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); return { secretName: secretKey, skipMultilineEncoding, @@ -2303,21 +2327,30 @@ export const secretServiceFactory = ({ secretReminderNote, secretReminderRepeatDays }) => { - const secretKeyEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: newSecretName || secretKey, - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); - const secretValueEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secretValue || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); - const secretCommentEncrypted = crypto.encryption().encryptSymmetric({ - plaintext: secretComment || "", - key: botKey, - keySize: SymmetricKeySize.Bits128 - }); + const secretKeyEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: newSecretName || secretKey, + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); + const secretValueEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secretValue || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); + const secretCommentEncrypted = crypto + .encryption() + .symmetric() + .encrypt({ + plaintext: secretComment || "", + key: botKey, + keySize: SymmetricKeySize.Bits128 + }); return { secretName: secretKey, newSecretName, @@ -2528,7 +2561,7 @@ export const secretServiceFactory = ({ }); return secretVersions.map((el) => { - const secretKey = crypto.encryption().decryptSymmetric({ + const secretKey = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretKeyCiphertext, iv: secret.secretKeyIV, tag: secret.secretKeyTag, @@ -2850,7 +2883,7 @@ export const secretServiceFactory = ({ secrets.map(({ id, secretValueCiphertext, secretValueIV, secretValueTag }) => ({ secretId: id, references: getAllNestedSecretReferences( - crypto.encryption().decryptSymmetric({ + crypto.encryption().symmetric().decrypt({ ciphertext: secretValueCiphertext, iv: secretValueIV, tag: secretValueTag, @@ -2955,7 +2988,7 @@ export const secretServiceFactory = ({ const destinationActions = [ProjectPermissionSecretActions.Create, ProjectPermissionSecretActions.Edit] as const; const decryptedSourceSecrets = sourceSecrets.map((secret) => { - const secretKey = crypto.encryption().decryptSymmetric({ + const secretKey = crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretKeyCiphertext, iv: secret.secretKeyIV, tag: secret.secretKeyTag, @@ -2996,7 +3029,7 @@ export const secretServiceFactory = ({ return { ...secret, secretKey, - secretValue: crypto.encryption().decryptSymmetric({ + secretValue: crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretValueCiphertext, iv: secret.secretValueIV, tag: secret.secretValueTag, @@ -3022,14 +3055,14 @@ export const secretServiceFactory = ({ const decryptedDestinationSecrets = destinationSecretsFromDB.map((secret) => { return { ...secret, - secretKey: crypto.encryption().decryptSymmetric({ + secretKey: crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretKeyCiphertext, iv: secret.secretKeyIV, tag: secret.secretKeyTag, key: botKey, keySize: SymmetricKeySize.Bits128 }), - secretValue: crypto.encryption().decryptSymmetric({ + secretValue: crypto.encryption().symmetric().decrypt({ ciphertext: secret.secretValueCiphertext, iv: secret.secretValueIV, tag: secret.secretValueTag, diff --git a/backend/src/services/super-admin/super-admin-service.ts b/backend/src/services/super-admin/super-admin-service.ts index 0de4950f0..ff47718f1 100644 --- a/backend/src/services/super-admin/super-admin-service.ts +++ b/backend/src/services/super-admin/super-admin-service.ts @@ -501,7 +501,7 @@ export const superAdminServiceFactory = ({ const hashedPassword = await crypto.hashing().createHash(password, appCfg.SALT_ROUNDS); - const { iv, tag, ciphertext, encoding } = crypto.encryption().encryptWithRootEncryptionKey(privateKey); + const { iv, tag, ciphertext, encoding } = crypto.encryption().symmetric().encryptWithRootEncryptionKey(privateKey); const userInfo = await userDAL.transaction(async (tx) => { const newUser = await userDAL.create( { @@ -587,7 +587,7 @@ export const superAdminServiceFactory = ({ }, tx ); - const { tag, encoding, ciphertext, iv } = crypto.encryption().encryptWithRootEncryptionKey(password); + const { tag, encoding, ciphertext, iv } = crypto.encryption().symmetric().encryptWithRootEncryptionKey(password); const encKeys = await generateUserSrpKeys(sanitizedEmail, password); const userEnc = await userDAL.createUserEncryption( diff --git a/backend/src/services/user/user-service.ts b/backend/src/services/user/user-service.ts index d4e392be1..b2258447e 100644 --- a/backend/src/services/user/user-service.ts +++ b/backend/src/services/user/user-service.ts @@ -218,12 +218,15 @@ export const userServiceFactory = ({ throw new NotFoundError({ message: `Private key for user with ID '${userId}' not found` }); } - const privateKey = crypto.encryption().decryptWithRootEncryptionKey({ - ciphertext: user.serverEncryptedPrivateKey, - tag: user.serverEncryptedPrivateKeyTag, - iv: user.serverEncryptedPrivateKeyIV, - keyEncoding: user.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding - }); + const privateKey = crypto + .encryption() + .symmetric() + .decryptWithRootEncryptionKey({ + ciphertext: user.serverEncryptedPrivateKey, + tag: user.serverEncryptedPrivateKeyTag, + iv: user.serverEncryptedPrivateKeyIV, + keyEncoding: user.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding + }); return privateKey; };